North Korea rebuts Binance hack allegations amid missile launch

North Korea has publicly rejected allegations that it was behind a reported $6 billion theft from the cryptocurrency platform Binance, while also carrying out a test launch of strategic cruise missiles. The denial came from Kim Yo Jong, the sister of leader Kim Jong Un, who described the FBI's claim as a grave political provocation. The missile test was reported separately as part of a new display of the country's weapons capabilities.

The FBI said on Saturday that a North Korea-affiliated hacking group called TraderTraitor was responsible for the Binance theft. Kim Yo Jong dismissed the allegation as absurd rhetoric and said it was nothing new, pointing to earlier US accusations over a major hack of Bybit last year. The report said experts view the Binance case as potentially the largest cryptocurrency theft in history, with the stolen amount equal to nearly a quarter of North Korea's estimated annual GDP.

The missile launch involved strategic cruise missiles fitted with a new cluster-munition warhead, according to the official Korean Central News Agency. The agency said the test improved the missile's terminal manoeuvrability and its ability to deliver a vertical strike against a target. A North Korean official said the launch was carried out because the armed forces should defend the country's security and deter threats.

The report also said the missiles were presented as capable of disabling key South Korean and US military infrastructure. The timing of the denial and the weapons test gives the episode wider significance beyond the cyber allegation alone. North Korea has long been accused by the United States and others of using cyber theft to generate revenue, and a 2024 United Nations report said proceeds from North Korean cyberattacks had reportedly helped fund the country's weapons of mass destruction programme.

That context makes any allegation of a major crypto theft politically sensitive as well as financially significant. The article also said the denial may be aimed at preserving channels through which North Korea can continue laundering and using cryptocurrency. Michael Bosack, founding director of the Parley Policy Institute and a former UN Command official, said the regime likely felt compelled to respond because of the level of international attention on the case.

He added that if outside parties close off access because of the scrutiny, the stolen cryptocurrency would be less useful to the regime's near-term priorities. What remains unclear is whether any of the alleged stolen funds can still be traced or recovered, and whether other governments will issue their own attribution. It is also not yet clear how the missile test will affect regional tensions or whether further launches will follow.

The case is likely to remain under close watch because it combines a major cyber allegation with a fresh show of force from Pyongyang.

Binance said on Sunday that it had resumed withdrawals after a major hack that affected more than $6 billion in funds. The exchange said the first phase reopened on the Bitcoin network, with access being restored in stages rather than all at once. It had suspended user withdrawals after the attack while it worked to contain the breach and assess the damage.

The company said it was taking a phased approach, prioritising tokens based on recent user demand and reopening each network only after stability and security checks were completed. Binance also said it had set aside more than $6.34 billion in company funds to cover losses from the hack. In an earlier statement, it said user funds remained safe and that it would absorb the financial impact itself rather than pass it on to customers.

The FBI said on Saturday that North Korea was behind the attack, identifying a group called TraderTraitor as responsible. That attribution adds a geopolitical dimension to an incident already seen as one of the largest crypto thefts on record. The bureau's claim follows earlier suspicions from private investigators and analysts, and it comes amid long-running concerns that North Korea uses cybercrime to generate revenue and support its weapons programme.

The breach has also had immediate market consequences, with prices of most major cryptocurrencies falling sharply after news of the cyberattack. Binance is the world's largest crypto exchange by daily trading volumes, so any disruption to its operations can affect trading confidence well beyond the company itself. The scale of the theft and the speed with which funds were moved have renewed scrutiny of how digital assets can be traced, frozen and recovered once they leave exchange wallets.

The incident fits a wider pattern of high-value crypto thefts that investigators have linked to North Korea in recent years. The FBI has previously accused the country of illicit cybercrime and virtual asset theft, and analysts have repeatedly warned that stolen funds can be broken into smaller amounts and moved through multiple networks to obscure their trail. Binance has not said how much of the stolen money remains unrecovered, and the company has not given a full timetable for restoring all withdrawals and deposits.

What remains unclear is how much of the missing funds can still be recovered and whether other agencies will issue their own attribution. It is also not yet clear how long the phased reopening will take or whether the exchange will face further operational disruption. The case is likely to remain under close watch because of its scale, the official US attribution and the potential impact on confidence in digital asset markets.

#NorthKorea #Binance #FBI #TraderTraitor #cruisemissiles